fix(templates): render allow-notify and correct allow-query-on statement

The zone option allow_notify was documented in defaults/main.yaml but never rendered by
named.conf.views.j2. Any allow_notify list configured for a zone was silently dropped, so
secondaries kept accepting NOTIFY messages only from the hosts listed in the masters statement.

In addition, the allow_query_on block emitted the statement name allow-query instead of
allow-query-on. This produced a second allow-query clause in the same zone and thereby
overrode the interface restriction that was actually intended.

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/ansible-linters.yaml

@@ -12,9 +12,9 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.1
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
     - name: Run ansible-lint
-      uses: ansible/ansible-lint@v25.12.2
+      uses: ansible/ansible-lint@665d9e07a1943254d2910faffc106adaf7ea7294 # v26.8.0
       with:
         args: "--config-file .ansible-lint"
         setup_python: "true"

.gitea/workflows/markdown-linters.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.1
-    - uses: DavidAnson/markdownlint-cli2-action@v21.0.0
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -0,0 +1,22 @@
+name: Release Ansible Role
+
+on:
+  push:
+    tags:
+    - '**'
+  workflow_dispatch: {}
+
+jobs:
+  release:
+    name: Release Ansible Role
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install Ansible Galaxy
+      run: |
+        apt update --yes
+        apt install --yes ansible
+    - env:
+        ANSIBLE_GALAXY_TOKEN: ${{ secrets.ANSIBLE_GALAXY_TOKEN }}
+      name: Update Ansible Role in Ansible Galaxy
+      run: |
+        ansible-galaxy role import --token=${ANSIBLE_GALAXY_TOKEN} volker-raschek ${GITHUB_REPOSITORY#*/}

.vscode/settings.json

@@ -0,0 +1,14 @@
+{
+  "ansible.python.interpreterPath": "/bin/python",
+  "files.associations": {
+    "**/.gitea/**/*.yml": "yaml",
+    "**/.gitea/**/*.yaml": "yaml",
+    "docker-compose*.yml": "dockercompose",
+    "*.yml": "ansible",
+    "*.yaml": "ansible",
+    ".yamllint": "yaml",
+    ".yamllint.yml": "yaml",
+    ".yamllint.yaml": "yaml"
+  },
+  "rewrap.wrappingColumn": 120
+}

tasks/main.yaml

@@ -1,7 +1,17 @@
 ---
 
 - name: Include OS-specific variables
-  ansible.builtin.include_vars: "{{ ansible_facts['os_family'] }}.yaml"
+  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
+  vars:
+    params:
+      files:
+      - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['architecture'] }}.yaml"
+      - "{{ ansible_facts['distribution'] }}.yaml"
+      - "{{ ansible_facts['os_family'] }}_{{ ansible_facts['architecture'] }}.yaml"
+      - "{{ ansible_facts['os_family'] }}.yaml"
+      - main.yaml
+      paths:
+      - vars
 
 - name: Install bind and dependencies
   ansible.builtin.package:

templates/etc/named/named.conf.views.j2

@@ -15,6 +15,25 @@ view "{{ view.name }}" {
 {% for zone in view.zones %}
   zone "{{ zone.config.origin }}" {
 
+    # allow-notify applies to slave zones only and defines a match list,
+    # e.g. IP address(es), that are allowed to NOTIFY the slave in
+    # addition to those hosts defined in the masters statement. By
+    # default only the hosts of the masters statement may send NOTIFY
+    # messages.
+    #
+    # NOTE:
+    # - This statement may be used in a zone, view or a global options
+    #   clause.
+{% if zone.config.allow_notify is defined and zone.config.allow_notify | length > 0 %}
+    allow-notify {
+{% for entry in zone.config.allow_notify %}
+      {{ entry }};
+{% endfor %}
+    };
+{% else %}
+    # allow-notify {};
+{% endif %}
+
     # Hosts which are allowed to issue queries to the server. If not specified all
     # hosts are allowed to make queries (defaults to allow-query {any;};
     #
@@ -41,7 +60,7 @@ view "{{ view.name }}" {
     # - The statements may be used in a zone, view or a global options
     #   clause.
 {% if zone.config.allow_query_on is defined and zone.config.allow_query_on | length > 0 %}
-    allow-query {
+    allow-query-on {
 {% for entry in zone.config.allow_query_on %}
       {{ entry }};
 {% endfor %}